Wysoka

HuggingFace transformers vulnerable to remote code execution

Ujawniono: 24.05.2026
Aktualizacja: 11.10.2026 15:17

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	transformers	< 5.3.0	5.3.0

Odnośniki

Ocena CVSS 7.8/10

Wektor CVSS: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Słabość (CWE): CWE-1066, CWE-502
Platforma: Python (PyPI)
Paczka: transformers
Ujawniono: 24.05.2026
Aktualizacja: 11.10.2026 15:17

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2026-2289 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-29pf-2h5f-8g72 - CC BY 4.0

Historia podatności: transformers

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (32) w archiwum

Wszystkich wpisów: 32
Pierwsza → ostatnia: 05.2023 09.2026
Bez poprawki: 9
Wykorzystywana w atakach: 0

Rozkład istotności

Wysoka 18
Średnia 12
Niska 2

Ujawnienia w latach

2023: 3
2024: 4
2025: 20
2026: 5

01.09.2026

Hugging Face Transformers downloads custom generation code before trust consent

Wysoka · 7.8 CVE-2026-80047 >= 4.49.0, <= 5.8.1 brak poprawki
02.08.2026

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

Wysoka · 7.1 CVE-2026-9856 < 5.10.0 5.10.0
03.06.2026

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

Wysoka · 8.0 CVE-2026-5241 < 5.5.0 5.5.0
24.05.2026

HuggingFace transformers vulnerable to remote code execution ten wpis

Wysoka · 7.8 CVE-2026-4372 < 5.3.0 5.3.0
23.12.2025

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of

Wysoka · 7.8 CVE-2025-14930 <= 4.57.1 brak poprawki
23.12.2025

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu

Wysoka · 7.8 CVE-2025-14928 <= 4.57.0 brak poprawki
23.12.2025

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af

Wysoka · 7.8 CVE-2025-14929 <= 5.0.0-rc0 brak poprawki
23.12.2025

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Huggi

Wysoka · 7.8 CVE-2025-14926 <= 4.57.0 brak poprawki
23.12.2025

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hug

Wysoka · 7.8 CVE-2025-14927 <= 4.57.0 brak poprawki
23.12.2025

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal

Wysoka · 7.8 CVE-2025-14920 <= 4.54.1 brak poprawki
23.12.2025

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i

Wysoka · 7.8 CVE-2025-14921 <= 4.54.1 brak poprawki
23.12.2025

Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa

Wysoka · 7.8 CVE-2025-14924 <= 4.55.0 brak poprawki
19.05.2025

A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) a

Wysoka · 7.5 CVE-2025-2099 < 4.49.0 4.49.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Wysoka · 8.8 CVE-2024-11394 < 4.48.0 4.48.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Wysoka · 8.8 CVE-2024-11393 < 4.48.0 4.48.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Wysoka · 7.5 CVE-2024-11392 < 4.48.0 4.48.0
20.12.2023

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Wysoka · 7.8 CVE-2023-7018 < 4.36.0 4.36.0
19.12.2023

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Wysoka · 8.8 CVE-2023-6730 < 4.36.0 4.36.0

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację